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Amendments to the Claims : 
This listing of claims replaces all prior versions and listings of claims in the application: 

Listing of Claims : 

1 . (original) A memory device storing a data structure for tracking network behavior, 
comprising: 

a connection table that maps each node of a network to a record object that stores 
information about traffic to or from the node and between that node and others nodes in the 
network. 

2. (original) The device of claim 1 wherein the connection table includes a plurality of 
records that are indexed by source address. 

3. (original) The device of claim 1 wherein the connection table includes a plurality of 
records that are indexed by destination address. 

4. (original) The device of claim 1 wherein the connection table includes a plurality of 
records that are indexed by time. 

5. (original) The device of claim 1 wherein the connection table includes a plurality of 
records that are indexed by source address, destination address and time. 

6. (original) The device of claim 1 wherein the connection table is a plurality of 
connection sub-tables each sub-table having data pertaining to network traffic over different time 
scales. 
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7. (original) The device of claim 1 wherein the connection sub-tables include a time-slice 
connection table that operates on a small unit of time and at least one other sub-table that 
operates on a larger unit of time than the time slice sub-table. 

8. (original) The device of claim 7 wherein the at one sub-table holds records received 
from all collectors over the time scale of the table. 

9. (original) The device of claim 5 wherein the addresses indexing the connection table 
are IP addresses. 

10 (Currently Amended) The device of claim 1 wherein the addresses indexing the 
connection table are include a physical layer later-address to IP address map that is used to 
determine Host ID. 

1 1 . (Currently Amended) The device of claim 1 wherein the host record of a first host 
abe maps to a second host which that communicates with the first host to a "host pair record 
object " that has information about all the traffic from b e tw ee n the first and to the second 
host[[s]] and from the second host to the first host . 

12. (Currently Amended) The device of claim 1 wherein the connection data structur e 
table includes two level mapping that enables a consuming device to obtain summary 
information about one host for a first level mapping and about the traffic between any pair of 
hosts, in either direction , between a first one of the hosts of the any pair to a second one of the 
hosts of the any pair and from the second one of the hosts of the any pair to the first one of the 
hosts of the any pair for a second level mapping . 

13. (original) The device of claim 1 wherein a record stores a measure of the number of 
bytes, packets, and connections that occurred between hosts during a given time-period. 

14. (original) The device of claim 1 wherein data in the record is organized by well 
known transport protocols and well-known application-level protocols. 
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15. (original) The device of claim 1 wherein host records have no specific memory limit. 

16. (original) The device of claim 1 wherein for application-level protocols and for every 
pair of hosts, the connection table stores statistics for traffic between the hosts. 

17. (original) The device of claim 16 wherein the connection table stores protocol- 
specific records as (protocol, count) key- value pairs. 



